Penetration Tester Career Roadmap for Beginners in India

Key takeaways

• Junior penetration testing roles are scarce. Most people get there through an adjacent job such as SOC analyst, system or network administrator, or developer.
• Skills stack in order: networking, Linux, scripting, web fundamentals, then Windows and Active Directory, then offensive techniques.
• CEH v13 (EC-Council) suits HR filters and gives breadth. OSCP (OffSec PEN-200) is a hands-on practical exam that technical interviewers respect.
• Reporting is half the job. Two or three well-written reports on legal lab targets beat a long list of tools.
• Test only systems you own or have written permission to test. In India, unauthorised access is an offence under the IT Act, 2000.

Most penetration testing roadmaps skip the uncomfortable part: junior pentest roles are scarce, and almost nobody walks into one directly. This roadmap is built around that reality: what to learn in what order, what to build, and which realistic first jobs lead to offensive security work.

What does a penetration tester actually do?

A penetration tester is hired by an organisation to find security weaknesses in its systems before real attackers do, and to report them clearly so they can be fixed. The work is done with a written scope and permission: which systems, which dates, which methods. A typical engagement has planning, information gathering, vulnerability discovery, controlled exploitation to prove impact, and then a report with fixes. Writing the report and talking to the client take as much time as the technical work.

How do you become a penetration tester?

Build networking and Linux fundamentals first, learn scripting, then study web and network security in a legal home lab, earn recognised certifications, and document your findings in a portfolio. Most people enter via a related role such as SOC analyst or system administrator before moving into offensive testing. Each layer depends on the one below it. Trying exploitation before you understand TCP/IP and Linux produces someone who can run tools but cannot explain results, and interviews expose that quickly.

What skills do you need first?

Networking, Linux and basic scripting are non-negotiable. Web application knowledge comes next because most real engagements involve web applications.

• Networking: TCP/IP, DNS, HTTP, ports, routing and how packets move. Learn to read a Wireshark capture.
• Linux: file permissions, users, processes, services, the shell. Most security tools run on it.
• Scripting: Python and Bash to automate tasks and adapt tools. The goal is to read and modify scripts, not to write huge programs.
• Web fundamentals: HTTP requests and responses, cookies and sessions, authentication, and the OWASP Top 10 risks.
• Windows and Active Directory: most corporate networks run on them, and AD misconfigurations are a staple of real findings.
• Security basics: cryptography at a practical level, common vulnerability classes, and how defenders detect attacks.

If you are starting from zero, spend three to six months here before touching offensive tools.

How do you build a legal practice lab?

Use targets that are deliberately vulnerable and that you own or run yourself. Never practise on a real company's website, a friend's server or your college network without written permission.

• A hypervisor such as VirtualBox or VMware on your own computer.
• An attacker machine: a Kali Linux or Parrot virtual machine.
• Intentionally vulnerable web apps: DVWA, OWASP Juice Shop and WebGoat.
• Intentionally vulnerable machines: Metasploitable and VulnHub images.
• Free, legal online labs: PortSwigger's Web Security Academy for web topics, and Hack The Box for machines and challenges.
• Later, a small Windows Active Directory lab on your own VMs.

Keep the lab on a host-only or isolated network, so vulnerable machines are not exposed to the internet or your home LAN.

Which tools should you learn?

Learn what each tool does and what its output means, as well as its commands.

Which certifications are worth it?

Certifications open doors. They do not replace ability. Pick the sequence by your stage.

A sensible order: fundamentals, then CEH for visibility, then a lot of lab practice, then OSCP. Official details are on the EC-Council CEH page and the OffSec PEN-200 page; check them for current prices, formats and renewal rules, because these change.

Candidates who can walk an interviewer through a finding they discovered themselves consistently do better than those who hold exam badges only.

What does the realistic career path look like?

Most Indian penetration testers arrive through an adjacent role. SOC analyst, system or network administrator and application security tester jobs give you the defensive and infrastructure context that makes offensive work meaningful, and they are far easier first jobs to obtain.

These durations are a shape, not a schedule. They vary widely with your prior IT experience and the hours you put in. People who already work in IT infrastructure or development often move faster because the foundations exist.

What should your portfolio contain?

Write up findings the way a professional report does: scope, method, evidence, impact and fix. Two or three well-documented write-ups from legal lab targets show more skill than a long list of installed tools. Publish them on a personal blog or GitHub, with no real-world sensitive data in them.

Reporting is genuinely half the job. A tester who finds a critical flaw but cannot explain its business impact adds less value than one who documents a moderate issue precisely.

What does a penetration test report contain?

• Executive summary: a one-page, non-technical view of risk for management.
• Scope and method: what was tested, when, and how, with the rules of engagement.
• Findings: each with a title, severity, affected asset, evidence such as screenshots or request and response, steps to reproduce, and the business impact.
• Remediation: specific, prioritised fixes the client's team can act on.
• Appendices: tool output, a list of tested hosts and references such as CVE identifiers.

Severity is often rated with CVSS, and known flaws are looked up in the National Vulnerability Database.

Is penetration testing legal in India?

Only with explicit written permission from the system's owner. Unauthorised access to a computer system is an offence under the Information Technology Act, 2000, regardless of your intent, and "I was only learning" is not a defence. Real engagements have a signed scope document. For practice, use your own lab and platforms that explicitly allow testing. Responsible disclosure programmes run by organisations are also a legal way to report weaknesses, as long as you follow their rules exactly.

Which areas can you specialise in?

• Web application testing: the most common starting point and the most jobs.
• Network and infrastructure testing: internal and external networks, Active Directory.
• Mobile application testing: Android and iOS.
• Cloud security testing: AWS, Azure and Google Cloud configuration and identity.
• Wireless testing: Wi-Fi security reviews.
• Red teaming: long, goal-based simulated attacks that need broad experience.

Common mistakes beginners make

• Jumping to Metasploit before understanding networking.
• Collecting certificates without lab or reporting experience.
• Practising on real websites without permission.
• Skipping Windows and Active Directory.
• Applying only for "pentester" roles and ignoring SOC and security engineering roles that lead there.

Next steps

This week, set up a virtual machine lab and complete one PortSwigger lab, then write it up in half a page. For structured guidance, WebAsha runs the Certified Ethical Hacking CEH v13 AI course for the entry stage and the OSCP course for the hands-on stage. For the wider picture, read our ethical hacking learning roadmap for India and our guide to the top cyber security certifications in India.

Related reading

• What is the roadmap for becoming a successful penetration tester in 2026? The Detailed RoadMap